Back to results
US 11,308,214 B2Granted
Binary translation for hardened software security
AssigneeIntel Corporation
InventorsIttai Anati, Stanley Gambarin
Life of this patent
Estimating the term…
Abstract
Processors in computerized systems can be targeted by hostile actors seeking to bypass security policies and may employ published or otherwise known vulnerabilities. Embodiments may include security subsystems and methods of operation that identify known vulnerabilities during execution and implement countermeasures or enforce security policies.
Claims20
A processor comprising:
- a native code subsystem comprising circuitry operable to execute a first instruction set, wherein the first instruction set is in a native code to the processor;
- a binary translation subsystem comprising circuitry operable to translate the first instruction set to a second instruction set, wherein the second instruction set is a processor internal code representation of the first instruction set;
- and
- a security subsystem comprising a security data structure that comprises a set of fix up target patterns and a set of countermeasures, wherein each fix up target pattern of the set of fix up target patterns comprises an instruction sequence, and wherein the security subsystem:
- parses the second instruction set to detect a sequence of a subset of the second instruction set that corresponds to an instruction sequence of a fix up target pattern of the set of fix up target patterns of the security data structure prior to execution by the native code subsystem;
- implements a countermeasure of the set of countermeasures of the security data structure associated with the fix up target pattern into the second instruction set;
- and
- performs the second instruction set in the native code subsystem or the binary translation subsystem, following implementation of the countermeasure.
5 more elements
A method comprising:
- receiving, by a native code subsystem of a processor, a sequence of instructions in a native instruction set using a native code to the processor;
- translating, by a binary translation subsystem of the processor, the sequence of instructions from the native instruction set to a processor internal code instruction set;
- identifying, by a security subsystem of the processor, a vulnerability in the translated sequence of instructions in the processor internal code instruction set by comparing the translated sequence of instructions with an instruction sequence of each fix up target pattern of a first set of fix up target patterns of a security data structure, wherein the vulnerability is associated with a fix up target pattern of the first set of fix up target patterns;
- and
- implementing, by the security subsystem, a countermeasure associated with the vulnerability, wherein the security data structure associates the countermeasure with the fix up target pattern.
2 more elements
A system comprising:
- a memory device comprising machine-readable instructions;
- and
- a processor to execute the machine-readable instructions, wherein the processor comprises a security data structure comprising a first set of fix up target patterns and a first set of countermeasures, wherein each fix up target pattern of the first set of fix up target patterns comprises an instruction sequence, and wherein each fix up target pattern of the first set of fix up target patterns is associated with at least one countermeasure of the first set of countermeasures, and wherein the processor is configured to:
- translate the machine readable instructions from a native instruction set to a processor internal code representation of the machine readable instructions;
- find at least one instruction sequence of at least one fix up target pattern of the first set of fix up target patterns of the security data structure in a sequence of the processor internal code representation of the machine-readable instructions prior to execution;
- and
- implementing a countermeasure of the first set of countermeasures of the security data structure, wherein the countermeasure is associated with the at least one fix up target pattern.
4 more elements
Dependencies are inferred from the claim text.